MTA-STS and TLS-RPT Checker

What the MTA-STS checker looks at

MTA-STS (RFC 8461) tells sending mail servers that your MX hosts support TLS with valid certificates, and that senders should refuse to deliver over an unencrypted or unverified connection. It has two parts, and the checker tests both:

• TXT record at _mta-sts.<domain>: v=STSv1; id=.... The id is 1 to 32 letters or digits. Senders refetch the policy whenever it changes.
• Policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt: fetched without following redirects, as the RFC requires. The checker parses version, mode, the mx patterns and max_age.
• MX coverage: every current MX host must match a policy mx line. A leading *. matches exactly one label, so *.mail.example.com matches a.mail.example.com but not a.b.mail.example.com.
• TLS-RPT (RFC 8460) at _smtp._tls.<domain>: v=TLSRPTv1; rua=mailto:... or https://. This is where senders report TLS failures to you.

How to read the result

The output shows the TXT record, the raw policy file, and each MX host with whether the policy covers it. In enforce mode, an uncovered MX is a delivery outage for senders that honor MTA-STS. In testing mode, senders only report.

Common problems

• Certificate on mta-sts.<domain> is missing or invalid: the policy host needs its own valid HTTPS certificate.
• Changed MX, old policy: after moving mail providers, update the mx lines and change the id, or cached policies will block delivery to the new hosts.
• max_age too large while testing: senders cache the policy for max_age seconds. Use a short value (for example 86400) until you are sure, then raise it (604800 or more).

Check the MX records themselves with MX Lookup.